img_auth.php doesn't support the HTTP Range header for byte range requests; this is needed for serving native MP4 video out to Safari on private wikis (will affect TimedMediaHandler and other extensions that serve videos to Safari as in this list post: https://lists.wikimedia.org/pipermail/mediawiki-l/2015-December/045126.html ).
Other browsers seem to fall back to single-request streaming sanely enough, but something's going wrong with it on Safari.
May need to update StreamFile and friends to handle the Range header on that end.